MALICIOUS — 4cdd9b29992e8d13033fd799bb78a3815a7947dd773b55b75e95bdd17fa11ae4

MALICIOUS — 4cdd9b29992e8d13033fd799bb78a3815a7947dd773b55b75e95bdd17fa11ae4 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Lmir family. 6 of 55 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 4cdd9b29992e8d13033fd799bb78a3815a7947dd773b55b75e95bdd17fa11ae4
SHA-1: 243e77385e33ad5e18e3b8b4fb2b69d6173deea5
MD5: 20981d8a61b68371fe3b534ec2f0cfc9
imphash: aae410db5a351d384de2e35faf59497e
ssdeep: 6144:rajdMJyFRe6azHqTGXHaeaE6aUmLSeRIC4:E2JylsKTUH6aG
TLSH: T15D459E3A538F2B57D132D6284D006B6E4472F8BA20FD5888226BD43DE7FEC9B7610255
Submitted as: 4cdd9b29992e8d13033fd799bb78a3815a7947dd773b55b75e95bdd17fa11ae4
File type: pe · Size: 275476 bytes
Verdict: malicious (100/100) · Family: Lmir

Detections (6 of 55 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Trojan.Lmir-22
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Virus:Win32/Viking.MR
Emsisoft (Emergency Kit): Dropped:Generic.Delf.Lmir.2EC949F5
Kaspersky (KVRT): Trojan-GameThief.Win32.Lmir.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Trojan.Lmir-22 (rule Win.Trojan.Lmir-22) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload: updater.exe - dynamic signal, weight 0.62, confidence 0.90
1 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 22 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

31803 behavior events · 2 ATT&CK techniques · 51 dropped files.

Dropped files

C:\Program Files\LibreOffice\program\sweb.exe - 3c550292a5ade3604f3d6c2970fd30b1e51890638ac7807930ce79fdaf31a0c7
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\kinit.exe - 055c4c6504b77c5833809619f6bf84cb3bdfbd8bbff69725dce109f6937facdf
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\ktab.exe - ae240c3ab2c6bf76c175fe61d74330ff3aeac2ff87142c6d749613794faf7bf2
C:\Program Files\LibreOffice\program\smath.exe - e1abf80fe5e48b40dd622bfd220a6925712bf139ba3ecc9a9797504406d20fa8
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jaccesswalker.exe - 965932c98939a62c498fefcffb0cf6d0f4217cf6b1bf182c15b83404ab8e50bb
C:\Program Files\LibreOffice\program\simpress.exe - a1fd3adc034900084a3dfe6a4e98cc4e3514a0e36e7560ae26204316459ffc6d
C:\Program Files\LibreOffice\program\quickstart.exe - a1e9356f9e24f4c33a1cc4188f90828f2b27524f64d126d6956c0cc0c7040f50
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\rmiregistry.exe - df8fa1ce2f9a07a3bd7f7f46622c75852bba4731a6396ec53efd5c531116fcae
C:\Program Files\LibreOffice\program\senddoc.exe - 830027946a417f42f1e2e73888a5fd578aedfc834510ab8d9e9488c7c352c80f
C:\Program Files\LibreOffice\program\soffice_safe.exe - b569be11a673bcb73cce66b8ee4d67f8b704c8a46e2a5b21d039bcc9777fea79
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jabswitch.exe - 9587ad90f0acb8bb0a7fd11c1de9909098dffdc150fd0be8f8a0d655f1d095a9
C:\Program Files\LibreOffice\program\python-core-3.12.13\bin\venvlauncher.exe - e9891a1bb5f3894d290fd12337342ebacbfbd7f038c9cb660448c50bdeae587a
C:\Program Files\LibreOffice\program\mar.exe - 39ee80a849ab6cfc08d0c03dfbbafb5f094afaf02e266fd0aefd4b39c12e34e6
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\java.exe - 89c832c935bc88cc7ef29b2703579b20e4620c12c83298d6ebbd91e3809a80c6

Embedded URLs

http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787930162&P2=404&P3=2&P4=BsjRERFT6f37CUFuP3D3EpN84lrPQ1cpR41W7f2OSEV1enOUno7a0%2bAUXCZJS4YRKBW1834gmsofKOCQaVc73w%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787930178&P2=404&P3=2&P4=hhgSEzCcNnXOmY7SkGFf9ZTVcEUAmXRIrRuBDMDI6sgsEaj%2fgO4OBmNX7289ECOmMZHobLiLcktvNSdkblSWyA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

crl.microsoft.com
www.microsoft.com

Embedded IP addresses

20.42.73.24
57.154.63.210
4.230.171.124
4.144.132.114
74.179.77.204
40.79.197.34
135.232.92.97
135.232.92.34
203.26.79.13
20.236.44.162
52.123.128.14
40.103.64.226
52.123.129.14
172.215.188.225
172.178.240.162
52.110.12.38
52.110.12.52
52.148.114.188
72.153.5.60
74.178.232.29
52.110.12.20
52.110.12.2

File paths

X:\:`:d:h:l:p:t:x:

More Lmir samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report